Sap Web Application Server

Vendor:

First CVE: Nov 16, 2005 · Active for 20 years

12

Total CVEs

More Total CVEs than 90% of tracked products

2.4

Avg CVEs / Year

Higher CVE frequency than 74% of tracked products

5.1

Avg CVSS

Higher Avg CVSS than 9% of tracked products

0.0%

KEV Rate

Bottom 1%

Trends Over Time

The number and severity of CVEs published that impact Sap Web Application Server over time

Volume of CVEsAvg CVSS Base Score

First CVE

Nov 16, 2005

20 years ago

Most Recent CVE

Jan 12, 2010

6,037 days ago

CVE Severity & Scoring

Sap Web Application Server12 CVEs

92%

8%

All CVEs352,231 CVEs

45%

40%

11%

MediumHigh

Attack Vector

Local0 (0.0%)

Network0 (0.0%)

Unknown12 (100.0%)

Physical0 (0.0%)

Adjacent Network0 (0.0%)

Attack Complexity

Low0 (0.0%)

High0 (0.0%)

Unknown12 (100.0%)

User Interaction

None0 (0.0%)

Unknown12 (100.0%)

Required0 (0.0%)

Privileges Required

Low0 (0.0%)

High0 (0.0%)

None0 (0.0%)

Unknown12 (100.0%)

Top CVEs

Signals from CVEs in this product scope (12 CVEs).

12 CVEs · Highest risk first

CVE	Published	CVSS	Risk	KEV	Exploit
CVE-2005-3634MEDIUM frameset.htm in the BSP runtime in SAP Web Application Server (WAS) 6.10 through 7.00 allows remote attackers to log users out and redirect them to arbitrary web sites via a close	Nov 16, 2005	5.0	38	NO	YES
CVE-2006-6010MEDIUM SAP allows remote attackers to obtain potentially sensitive information such as operating system and SAP version via an RFC_SYSTEM_INFO RfcCallReceive request, a different vulnerab	Nov 21, 2006	5.0	28	NO	YES
CVE-2006-1039MEDIUM SAP Web Application Server (WebAS) Kernel before 7.0 allows remote attackers to inject arbitrary bytes into the HTTP response and obtain sensitive authentication information, or ha	Mar 7, 2006	6.4	26	NO	YES
CVE-2005-3636MEDIUM Cross-site scripting (XSS) vulnerability in SAP Web Application Server (WAS) 6.10 allows remote attackers to inject arbitrary web script or HTML via Error Pages.	Nov 16, 2005	4.3	25	NO	YES
CVE-2006-5784MEDIUM Unspecified vulnerability in enserver.exe in SAP Web Application Server 6.40 before patch 136 and 7.00 before patch 66 allows remote attackers to read arbitrary files via crafted d	Nov 7, 2006	4.6	22	NO	YES
CVE-2005-3635MEDIUM Multiple cross-site scripting (XSS) vulnerabilities in SAP Web Application Server (WAS) 6.10 through 7.00 allow remote attackers to inject arbitrary web script or HTML via (1) the	Nov 16, 2005	4.3	22	NO	YES
CVE-2008-2421MEDIUM Cross-site scripting (XSS) vulnerability in the Web GUI in SAP Web Application Server (WAS) 7.0, Web Dynpro for ABAP (aka WD4A or WDA), and Web Dynpro for BSP allows remote attacke	May 23, 2008	4.3	21	NO	YES
CVE-2007-3615HIGH Internet Communication Manager (aka ICMAN.exe or ICM) in SAP NetWeaver Application Server 6.x and 7.x, possibly only on Windows, allows remote attackers to cause a denial of servic	Jul 6, 2007	7.8	20	NO	NO
CVE-2009-4603MEDIUM Unspecified vulnerability in sapstartsrv.exe in the SAP Kernel 6.40, 7.00, 7.01, 7.10, 7.11, and 7.20, as used in SAP NetWeaver 7.x and SAP Web Application Server 6.x and 7.x, allo	Jan 12, 2010	5.0	16	NO	NO
CVE-2006-6011MEDIUM Unspecified vulnerability in SAP Web Application Server before 6.40 patch 6 allows remote attackers to cause a denial of service (enserver.exe crash) via a certain UDP packet to po	Nov 21, 2006	5.0	15	NO	NO

View all 12 CVEs →

Exploit Exposure

Signals from CVEs in this product scope (12 CVEs).

CISA KEV

0 CVEs

0.0% of CVEs· Bottom 1%

Metasploit

1 CVE

8.3% of CVEs· 97th percentile

Nuclei

1 CVE

8.3% of CVEs· 97th percentile

ExploitDB

6 CVEs

50.0% of CVEs· 91st percentile

Social Chatter

Signals from CVEs in this product scope (12 CVEs).

Media Mentions

Signals from CVEs in this product scope (12 CVEs).

Top CNAs Publishing CVEs For Sap Web Application Server

Top CWEs

Versions

Version	CVE Count	Avg CVSS	Avg EPSS	Exploits
7.0.10	1	7.8	2.4%	0
7.00	2	4.8	2.4%	1
7.0	5	5.3	5.8%	3
6.40	8	5.4	4.5%	4
6.20	5	5.7	6.0%	3
6.10	6	5.5	5.8%	4